US Gov confirms PHP2Shell exploited by October 31, 2026?

Analysis

CISA's own alert, published on 21 October, said it had not observed exploitation of CVE-2026-109618 and CVE-2026-109619 as of publication. The same alert urged organisations to patch immediately. A catalog re-check reported on 22 October found neither CVE listed in the Known Exploited Vulnerabilities catalog (version 2026.10.21). The forecast still leans towards an addition by the end of 31 October, 11:59 PM ET, because the picture is moving. Amazon said it identified a PHP2Shell exploitation attempt on 17 October against one of its decoy systems. Independent reporting dated 22 October says security vendors are now describing exploitation beyond honeypots. That reporting also says official agencies have yet to confirm it, so these are vendor claims and not established fact. Government attention is also reported to be high. The NSA urged organisations using PHP to prepare security updates and, if immediate updates are not possible, to consider taking affected systems offline. The FBI warned that attackers could exploit the flaws to run code remotely. A sceptic should note the gap between warnings and a catalog entry. A catalog entry needs CISA itself to accept that exploitation is happening, and its latest stated position was that it had not seen any. Only about nine days remain, and either CVE qualifies, which helps the case for addition. The thing to watch is whether CISA updates its alert, or the catalog shows a Date Added entry, for either CVE.